From what I have read about PKCE, it is possible for malicious browser extensions to steal the authorization code from the browser history, but not the code verifier. If this is true, then why bother hashing the code verifier to make a code challenge?
You hash the code verifier to make it even harder for an attacker to steal it. If they manage to somehow intercept the code challenge sent in the authorization request, it is still not enough, as you need the original code verifier to exchange the authorization code for an access token. It's just another measure that increases the level of security in PKCE.
It's not obligatory to hash the code verifier, by the way. One of the "hashing methods" in the specification is "plain", which means that you don't hash the verifier. Though it is recommended to hash it, if there are no obstacles to do that.